Re: [fw-wiz] Query on OS hardening

From: Volker Tanger (volker.tanger@discon.de)
Date: 02/20/03

  • Next message: Loomis, Rip: "RE: [fw-wiz] DNS UDP packets > 512 bytes" 
    From: Volker Tanger <volker.tanger@discon.de>
To: firewall-wizards@honor.icsalabs.com
Date: Thu, 20 Feb 2003 13:54:17 +0100

    Greetings!

    Carson Gaspar wrote:
    >
    > <volker.tanger@discon.de> wrote:
    >
    >> Quite easy: SSH with distributed keys plus some simple shell scripting.
    >> Main advantage is that you won't need to install anything (fancy) on
    >> the system in question.
    >
    > Ah yes... and how much CPU do you have to spare for SSH session setup
    > (on both the systemn being monitored and your monitoring server)? And
    > how often do you want to collect the data?

    On one of the instances I am running the check interval varies 1-5
    minutes depending on service, averaging at a bit less than 3 minutes.
    Overall load on the management server (P2/400 with 128MB) is 0.1
    (uptime) with >100 service checks via SSH. CPU idle (vmstat) averages at 92%

    So, yes you are right, you'll have to have an eye on your ressources.
    But as long as the central server is basically idling and your checked
    machines do the same, I see no problems here.

    I tried to run a compromise in older version of ASLCceck where multiple
    checks were done within in one single SSH session. But with too much
    idle CPU power to burn in *my* setup I decided to split checks and have
    a separate SSH session for each single check.

    Main advantages:
            - flexibility
            - no (additional) software needed (at all) on the
              machines checked

    Main disadvantage:
            - high(er) CPU and network load on server and client

    So as long as you know what you're doing...
    ;-)

    So thanks for explicitly pointing to that problem - and for this reason
    fowarded to FWTOOLS, too.
    Bye

    Volker Tanger
    IT-Security Consulting 

    -- 
discon gmbh
Wrangelstraße 100
D-10997 Berlin
Telefon  (030) 6104-3307
Telefax  (030) 6104-3461
volker.tanger@discon.de
http://www.discon.de/
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

    Relevant Pages

    • Re: Apache Software Foundation Server compromised, resecured. (fwd)
      ... this was one "result" of the comromised ssh binary at sourceforge. ... a public server of the Apache Software Foundation ... > (ASF) was illegally accessed by unknown crackers. ... > exhaustive audit of all Apache source code and binary distributions ...
      (FreeBSD-Security)
    • Re: FreeBSD Crash without Errors, Warnings, or Panics
      ... I suppose I could run on stable until the driver is fixed in a release branch, but I need this box up and online, and I've always read that the stable branch is not the place for production servers. ... I'm running 6.0-RELEASE-p5 on a Toshiba built server: dual Xeon Intel motherboard with a LSILogic MegaRAID controller. ... Also, some network ports still respond, like a telnet to port 22 to test SSH will yield an SSH banner, but trying to connect with SSH just hangs. ... The box runs a web-based app and connects to a local Postgres DB which seemed to be unable to start new connections being requested by the PHP scripts. ...
      (freebsd-hackers)
    • Re: restrict ssh access
      ... > We have one ssh server which receives about 6000 failed attempts to ... > unsuccessful login attempts per client IP address? ... the remote server is also running OpenSSH. ...
      (comp.security.ssh)
    • Re: SSH as root
      ... Subject: SSH as root ... but it doesn't require having a key on the server that could be ... If they compromise a server, and the passphrase, etc. is there, they only ... private key to anyone. ...
      (SSH)
    • Re: Explanation of SSH
      ... I am still unclear on how SSH works exactly. ... Client issues SSH command and names server ... "Shopper" says "server sends back its public host and server keys ... Surely there is only one public key it sends ...
      (comp.security.ssh)